CC
Vendor security profile
Concrete CMS
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs110
Critical0
CISA KEV0
Public exploit3
Patch rate%0
Avg. CVSS5.7
12-month vulnerability rate
0
0
0
0
0
0
44
1
0
0
65
0
CVE KEV
CVE severity distribution
110toplam CVE
High39 (35%)
Medium48 (44%)
Low23 (21%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%3
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
110Unknown
Latest vulnerabilities
6.3
CVE-2026-18120
Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data
CC
Patch status unknownEPSS %0
2.0
CVE-2026-85387
Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
CC
Patch status unknownEPSS %0
2.1
CVE-2026-87031
Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation
CC
Patch status unknownEPSS %0
5.3
CVE-2026-87028
Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields
CC
Patch status unknownEPSS %0
7.3
CVE-2026-85386
Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block
CC
Patch status unknownEPSS %0
7.7
CVE-2026-85385
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
CC
Patch status unknownEPSS %1
1.8
CVE-2026-81927
Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
CC
Patch status unknownEPSS %0
2.0
CVE-2026-18426
Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit
CC
Patch status unknownEPSS %0
2.0
CVE-2026-81926
Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog
CC
Patch status unknownEPSS %0
2.1
CVE-2026-81925
Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
CC
Patch status unknownEPSS %0